Bug 104735 – ASSERT running platform/mac/plugins/convert-point.html on the WK2 bots

• Status: RESOLVED
• Resolution: WONTFIX
• Component: Plug-ins

[Beth Dakin]

platform/mac/plugins/convert-point.html asserts on the WK2 bots. I can reproduce this reliably on my computer, but only when I run the test in WebKit Test Runner. (It does not repro if you just load the test in the browser.)

ASSERT(!object->isSetNeedsLayoutForbidden());
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000108621d50 WebCore::RenderObject::markContainingBlocksForLayout(bool, WebCore::RenderObject*) + 992 (RenderObject.cpp:683)
1   com.apple.WebCore             	0x000000010764d9d0 WebCore::RenderObject::setNeedsLayout(bool, WebCore::MarkingBehavior) + 224 (RenderObject.h:1175)
2   com.apple.WebCore             	0x000000010761b7a2 WebCore::RenderObject::setNeedsLayoutAndPrefWidthsRecalc() + 34 (RenderObject.h:662)
3   com.apple.WebCore             	0x000000010871f5b4 WebCore::RenderText::setText(WTF::PassRefPtr<WTF::StringImpl>, bool) + 260 (RenderText.cpp:1466)
4   com.apple.WebCore             	0x000000010871e913 WebCore::RenderText::setTextWithOffset(WTF::PassRefPtr<WTF::StringImpl>, unsigned int, unsigned int, bool) + 1219 (RenderText.cpp:1339)
5   com.apple.WebCore             	0x0000000108afbe1e WebCore::Text::updateTextRenderer(unsigned int, unsigned int) + 286 (Text.cpp:314)
6   com.apple.WebCore             	0x000000010738533c WebCore::CharacterData::setDataAndUpdate(WTF::String const&, unsigned int, unsigned int, unsigned int) + 252 (CharacterData.cpp:204)
7   com.apple.WebCore             	0x000000010738520b WebCore::CharacterData::setData(WTF::String const&, int&) + 187 (CharacterData.cpp:54)
8   com.apple.WebCore             	0x00000001082f6325 WebCore::replaceChildrenWithFragment(WebCore::ContainerNode*, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) + 261 (markup.cpp:1120)
9   com.apple.WebCore             	0x0000000107a6b41c WebCore::HTMLElement::setInnerHTML(WTF::String const&, int&) + 156 (HTMLElement.cpp:354)
10  com.apple.WebCore             	0x0000000107ee456a WebCore::setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue) + 106 (JSHTMLElement.cpp:544)
11  com.apple.WebCore             	0x0000000107ee65d9 bool JSC::lookupPut<WebCore::JSHTMLElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*, bool) + 249 (Lookup.h:373)
12  com.apple.WebCore             	0x0000000107ee6078 void JSC::lookupPut<WebCore::JSHTMLElement, WebCore::JSElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*, JSC::PutPropertySlot&) + 120 (Lookup.h:389)
13  com.apple.WebCore             	0x0000000107ee32b7 WebCore::JSHTMLElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 279 (JSHTMLElement.cpp:446)
14  com.apple.WebCore             	0x0000000107edc98c void JSC::lookupPut<WebCore::JSHTMLDivElement, WebCore::JSHTMLElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLDivElement*, JSC::PutPropertySlot&) + 172 (Lookup.h:391)
15  com.apple.WebCore             	0x0000000107edba17 WebCore::JSHTMLDivElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 279 (JSHTMLDivElement.cpp:144)
16  com.apple.JavaScriptCore      	0x0000000106348099 JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 185 (JSObject.h:1523)
17  com.apple.JavaScriptCore      	0x00000001065f4610 llint_slow_path_put_by_id + 416 (LLIntSlowPaths.cpp:981)
18  com.apple.JavaScriptCore      	0x00000001065fd5a7 llint_op_put_by_id + 155
19  com.apple.JavaScriptCore      	0x00000001063f8494 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*) + 84 (JITCode.h:134)
20  com.apple.JavaScriptCore      	0x00000001063f4f3f JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 4735 (Interpreter.cpp:983)
21  com.apple.JavaScriptCore      	0x00000001062be383 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 483 (Completion.cpp:75)
22  com.apple.WebKit2             	0x0000000104f96f9d WebKit::NPRuntimeObjectMap::evaluate(NPObject*, WTF::String const&, _NPVariant*) + 349 (SourceCode.h:93)
23  com.apple.WebKit2             	0x0000000104ff20c3 WebKit::PluginView::evaluate(NPObject*, WTF::String const&, _NPVariant*, bool) + 179 (PluginView.cpp:1285)
24  com.apple.WebKit2             	0x0000000104ff214b non-virtual thunk to WebKit::PluginView::evaluate(NPObject*, WTF::String const&, _NPVariant*, bool) + 91
25  com.apple.WebKit2             	0x0000000104fe22d9 WebKit::PluginProxy::evaluate(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&) + 249 (PluginProxy.cpp:611)
26  com.apple.WebKit2             	0x0000000104feaf26 void CoreIPC::callMemberFunction<WebKit::PluginProxy, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&), WebKit::NPVariantData, WTF::String, bool, bool, WebKit::NPVariantData>(CoreIPC::Arguments3<WebKit::NPVariantData, WTF::String, bool> const&, CoreIPC::Arguments2<bool, WebKit::NPVariantData>&, WebKit::PluginProxy*, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&)) + 214 (HandleMessage.h:150)
27  com.apple.WebKit2             	0x0000000104fea9de void CoreIPC::handleMessage<Messages::PluginProxy::Evaluate, WebKit::PluginProxy, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&)>(CoreIPC::MessageDecoder&, CoreIPC::MessageEncoder&, WebKit::PluginProxy*, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&)) + 190 (HandleMessage.h:333)
28  com.apple.WebKit2             	0x0000000104fe9eb5 WebKit::PluginProxy::didReceiveSyncPluginProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, WTF::OwnPtr<CoreIPC::MessageEncoder>&) + 949 (PluginProxyMessageReceiver.cpp:118)
29  com.apple.WebKit2             	0x0000000104fc688c WebKit::PluginProcessConnection::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, WTF::OwnPtr<CoreIPC::MessageEncoder>&) + 252 (PluginProcessConnection.cpp:121)
30  com.apple.WebKit2             	0x0000000104ed1b50 CoreIPC::Connection::dispatchSyncMessage(CoreIPC::MessageID, CoreIPC::MessageDecoder&) + 320 (Connection.cpp:635)
31  com.apple.WebKit2             	0x0000000104ecf215 CoreIPC::Connection::dispatchMessage(CoreIPC::Connection::Message<CoreIPC::MessageDecoder>&) + 277 (Connection.cpp:682)
32  com.apple.WebKit2             	0x0000000104ecf0cf CoreIPC::Connection::SyncMessageState::dispatchMessages() + 255 (Connection.cpp:166)
33  com.apple.WebKit2             	0x0000000104ed0d06 CoreIPC::Connection::waitForSyncReply(unsigned long long, double, unsigned int) + 166 (Connection.cpp:431)
34  com.apple.WebKit2             	0x0000000104ed0b20 CoreIPC::Connection::sendSyncMessage(CoreIPC::MessageID, unsigned long long, WTF::PassOwnPtr<CoreIPC::MessageEncoder>, double, unsigned int) + 528 (Connection.cpp:405)
35  com.apple.WebKit2             	0x0000000104fe3211 bool CoreIPC::Connection::sendSync<Messages::PluginControllerProxy::PaintEntirePlugin>(Messages::PluginControllerProxy::PaintEntirePlugin const&, Messages::PluginControllerProxy::PaintEntirePlugin::Reply const&, unsigned long long, double, unsigned int) + 305 (Connection.h:419)
36  com.apple.WebKit2             	0x0000000104fe0585 WebKit::PluginProxy::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 181 (PluginProxy.cpp:213)
37  com.apple.WebKit2             	0x0000000104fef7a7 WebKit::PluginView::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 839 (PluginView.cpp:723)
38  com.apple.WebCore             	0x000000010874cc06 WebCore::RenderWidget::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 2166 (RenderWidget.cpp:293)
39  com.apple.WebCore             	0x000000010855ca14 WebCore::RenderEmbeddedObject::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 340 (RenderEmbeddedObject.cpp:168)
40  com.apple.WebCore             	0x0000000107b97faf WebCore::InlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 575 (InlineBox.cpp:241)
41  com.apple.WebCore             	0x0000000107b9f3a3 WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 1347 (InlineFlowBox.cpp:1119)
42  com.apple.WebCore             	0x0000000108784c63 WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 115 (RootInlineBox.cpp:210)
43  com.apple.WebCore             	0x00000001085efa2f WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) const + 2319 (RenderLineBoxList.cpp:232)
44  com.apple.WebCore             	0x0000000108498a42 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 162 (RenderBlock.cpp:2883)
45  com.apple.WebCore             	0x0000000108499612 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 578 (RenderBlock.cpp:3006)
46  com.apple.WebCore             	0x0000000108496aed WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 317 (RenderBlock.cpp:2718)
47  com.apple.WebCore             	0x0000000108498f38 WebCore::RenderBlock::paintChild(WebCore::RenderBox*, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 856 (RenderBlock.cpp:2937)
48  com.apple.WebCore             	0x0000000108498bb7 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 103 (RenderBlock.cpp:2903)
49  com.apple.WebCore             	0x0000000108498b3a WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 410 (RenderBlock.cpp:2898)
50  com.apple.WebCore             	0x0000000108499612 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 578 (RenderBlock.cpp:3006)
51  com.apple.WebCore             	0x0000000108496aed WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 317 (RenderBlock.cpp:2718)
52  com.apple.WebCore             	0x0000000108498f38 WebCore::RenderBlock::paintChild(WebCore::RenderBox*, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 856 (RenderBlock.cpp:2937)
53  com.apple.WebCore             	0x0000000108498bb7 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 103 (RenderBlock.cpp:2903)
54  com.apple.WebCore             	0x0000000108498b3a WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 410 (RenderBlock.cpp:2898)
55  com.apple.WebCore             	0x0000000108499612 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 578 (RenderBlock.cpp:3006)
56  com.apple.WebCore             	0x0000000108496aed WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 317 (RenderBlock.cpp:2718)
57  com.apple.WebCore             	0x00000001085afd78 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 4168 (RenderLayer.cpp:3436)
58  com.apple.WebCore             	0x00000001085aed1b WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 283 (RenderLayer.cpp:3240)
59  com.apple.WebCore             	0x00000001085ae3e5 WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 1701 (RenderLayer.cpp:3222)
60  com.apple.WebCore             	0x00000001085b0cd9 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 185 (RenderLayer.cpp:3523)
61  com.apple.WebCore             	0x00000001085affc5 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 4757 (RenderLayer.cpp:3461)
62  com.apple.WebCore             	0x00000001085aed1b WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 283 (RenderLayer.cpp:3240)
63  com.apple.WebCore             	0x00000001085ae3e5 WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 1701 (RenderLayer.cpp:3222)
64  com.apple.WebCore             	0x00000001085adc7e WebCore::RenderLayer::paint(WebCore::GraphicsContext*, WebCore::LayoutRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, unsigned int) + 254 (RenderLayer.cpp:3026)
65  com.apple.WebCore             	0x000000010796c096 WebCore::FrameView::paintContents(WebCore::GraphicsContext*, WebCore::IntRect const&) + 1446 (FrameView.cpp:3267)
66  com.apple.WebCore             	0x000000010882b562 WebCore::ScrollView::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 914 (ScrollView.cpp:1076)
67  com.apple.WebKit2             	0x00000001050fdfb4 WebKit::WebPage::drawRect(WebCore::GraphicsContext&, WebCore::IntRect const&) + 292 (WebPage.cpp:1111)
68  com.apple.WebKit2             	0x0000000104ef2ca1 WebKit::DrawingAreaImpl::display(WebKit::UpdateInfo&) + 1585 (DrawingAreaImpl.cpp:721)
69  com.apple.WebKit2             	0x0000000104ef181f WebKit::DrawingAreaImpl::display() + 415 (DrawingAreaImpl.cpp:624)
70  com.apple.WebKit2             	0x0000000104ef03f5 WebKit::DrawingAreaImpl::displayTimerFired() + 21 (DrawingAreaImpl.cpp:602)
71  com.apple.WebKit2             	0x0000000104ef50bb WebCore::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired() + 107 (RunLoop.h:123)
72  com.apple.WebCore             	0x00000001087a0e06 WebCore::RunLoop::TimerBase::timerFired(__CFRunLoopTimer*, void*) + 86 (RunLoopCF.cpp:138)
73  com.apple.CoreFoundation      	0x00007fff82e40da4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
74  com.apple.CoreFoundation      	0x00007fff82e408bd __CFRunLoopDoTimer + 557
75  com.apple.CoreFoundation      	0x00007fff82e26099 __CFRunLoopRun + 1513
76  com.apple.CoreFoundation      	0x00007fff82e256b2 CFRunLoopRunSpecific + 290
77  com.apple.HIToolbox           	0x00007fff86a900a4 RunCurrentEventLoopInMode + 209
78  com.apple.HIToolbox           	0x00007fff86a8fe42 ReceiveNextEventCommon + 356
79  com.apple.HIToolbox           	0x00007fff86a8fcd3 BlockUntilNextEventMatchingListInMode + 62
80  com.apple.AppKit              	0x00007fff8b6db613 _DPSNextEvent + 685
81  com.apple.AppKit              	0x00007fff8b6daed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
82  com.apple.AppKit              	0x00007fff8b6d2283 -[NSApplication run] + 517
83  com.apple.WebCore             	0x00000001087a174c WebCore::RunLoop::run() + 92 (RunLoopMac.mm:37)
84  com.apple.WebKit2             	0x00000001051f0d53 WebKit::WebProcessMain(WebKit::CommandLine const&) + 4451 (WebProcessMainMac.mm:187)
85  com.apple.WebKit2             	0x00000001050deaea WebKitMain(WebKit::CommandLine const&) + 202 (WebKitMain.cpp:58)
86  com.apple.WebKit2             	0x00000001050de9f9 WebKitMain + 153 (WebKitMain.cpp:88)
87  com.apple.WebProcess          	0x0000000104e66da2 main + 274 (MainMacProcess.cpp:68)
88  libdyld.dylib                 	0x00007fff882417e1 start + 1

[Tony Chang]

It looks like during paint, we're running javascript (something to do with the sync plugin call?). That seems like the real bug, not the addition of the assert.

Is repaint really supposed to be able to trigger javascript?

[Anders Carlsson]

(In reply to comment #1)
> Is repaint really supposed to be able to trigger javascript?

Nope, and we have code in place that tries to avoid it.

[Beth Dakin]

I skipped the test for now with http://trac.webkit.org/changeset/137385

[Anders Carlsson]

OK, the plug-in test is doing a bunch of work in NPP_SetWindow. Plug-ins shouldn't do that, and I don't know of any real-world plug-ins that do this.

We should just fix the test to run in NPP_New instead of NPP_SetWindow.

[Anders Carlsson]

Created attachment 178923 [details]
Patch

[Alexey Proskuryakov]

Mass closing plug-in bugs, as plug-in support has been removed from WebKit.

Please comment and/or reopen if this still affects WebKit in some way.